{"id":"CVE-2026-121674","kind":"vulnerability","aliases":["CVE-2026-121674"],"related":[],"title":"PowerShell Core: sensitive data inserted into network traffic leaks information","description":"Insertion of sensitive information into sent data in Microsoft PowerShell Core allows an unauthorized attacker to disclose information over a network.","summary":"Microsoft PowerShell Core inserts sensitive information into data it sends, so an unauthorized attacker on the network can read it. The sources give no further detail on which data or which conditions trigger it.","severity":"medium","cvss":6.1,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"PowerShell Core","fixed":[],"affected":"","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["linux","macos","powershell","runtime","windows"],"not_affected_if":[],"how_to_check":"- Run `pwsh --version` to find the installed PowerShell Core version.\n- Compare it against the affected version ranges in the Microsoft advisory for CVE-2026-121674; the sources do not list them.","fix":null,"status":"open","published_at":"2026-11-10T19:20:31+00:00","first_seen_at":"2026-11-10T19:25:09+00:00","triaged_at":"2026-11-10T19:58:31+00:00","updated_at":"2026-11-10T19:58:31+00:00","category":"runtime","confidence":0.5,"triage":{"at":"2026-11-10T19:58:31Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"network","title":"PowerShell Core: sensitive data inserted into network traffic leaks information","impact":"low","summary":"Microsoft PowerShell Core inserts sensitive information into data it sends, so an unauthorized attacker on the network can read it. The sources give no further detail on which data or which conditions trigger it.","audience":"businesses","category":"runtime","nicknames":[],"who_cares":["powershell","windows","linux","macos"],"confidence":0.5,"fix_status":"unknown","needs_auth":"unknown","worst_case":"Attacker reads sensitive information from network traffic sent by PowerShell Core.","analyst_note":"Find the affected version ranges and fixed version in the Microsoft Security Response Center entry for CVE-2026-121674 and the NVD page https://nvd.nist.gov/vuln/detail/CVE-2026-121674.","how_to_check":"- Run `pwsh --version` to find the installed PowerShell Core version.\n- Compare it against the affected version ranges in the Microsoft advisory for CVE-2026-121674; the sources do not list them.","plain_action":"","product_name":"PowerShell Core","needs_analyst":true,"not_affected_if":[],"who_is_affected":"Teams that run PowerShell Core on servers or workstations where it sends data over a network. The sources do not say which configurations or features are needed, so unknown. Systems that do not use PowerShell Core are not affected.","user_interaction":"unknown","product_ecosystem":"vendor","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000729,"input_tokens":4503,"output_tokens":557,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-121674':13A,16A '-2026':12A,15A 'allow':68C 'attack':37B,71C 'condit':55B 'core':2A,18A,26B,67C 'cve':11A,14A 'data':4A,31B,52B,63C 'detail':49B 'disclos':73C 'give':46B 'inform':10A,29B,60C,74C 'insert':5A,27B,57C 'leak':9A 'linux':19B 'maco':20B 'microsoft':24B,65C 'network':7A,40B,77C 'powershel':1A,21B,25B,66C 'powershell':17A 'read':42B 'runtim':22B 'send':33B 'sensit':3A,28B,59C 'sent':62C 'sourc':45B 'traffic':8A 'trigger':56B 'unauthor':36B,70C 'window':23B","nicknames":[],"mitigations":[],"who_affected":"Teams that run PowerShell Core on servers or workstations where it sends data over a network. The sources do not say which configurations or features are needed, so unknown. Systems that do not use PowerShell Core are not affected.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"pkeys":["core","powershellcore"],"ptokens":["core","powershell"],"labels":["linux","macos","medium","powershell","runtime","vendor","windows"],"campaign_type":null,"search_a":"'-121674':13A,16A '-2026':12A,15A 'core':2A,18A 'cve':11A,14A 'data':4A 'inform':10A 'insert':5A 'leak':9A 'network':7A 'powershel':1A 'powershell':17A 'sensit':3A 'traffic':8A","search_b":"'attack':37B 'condit':55B 'core':26B 'data':31B,52B 'detail':49B 'give':46B 'inform':29B 'insert':27B 'linux':19B 'maco':20B 'microsoft':24B 'network':40B 'powershel':21B,25B 'read':42B 'runtim':22B 'send':33B 'sensit':28B 'sourc':45B 'trigger':56B 'unauthor':36B 'window':23B","search_c":"'allow':68C 'attack':71C 'core':67C 'data':63C 'disclos':73C 'inform':60C,74C 'insert':57C 'microsoft':65C 'network':77C 'powershel':66C 'sensit':59C 'sent':62C 'unauthor':70C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-10T19:20:31+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:N/A:N","cvss_by":"secure@microsoft.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-121674","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-121674","severity":null,"published_at":"2026-11-10T19:20:31+00:00","modified_at":"2026-11-10T19:20:31+00:00","first_seen_at":"2026-11-10T19:25:09+00:00","fetched_at":"2026-11-10T19:25:09+00:00","note":null}],"documents":[],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}